Skip to main content

Ingress Management

A syslog source is a device, not an application: one template can serve hundreds of firewalls and servers, and its Running badge says nothing about any one of them. So for syslog, the platform keeps track of the senders themselves. Every syslog parser registers the devices it hears from as assets, and counts what each one sends; those counts are what metric alerts watch. This page covers that inventory, and the job of noticing when a device goes quiet.

Sources on the other transports are watched through their own applications instead; see Confirming It Works on API Polling, HEC, Webhooks, Cloud Storage and Event Streams.

The Asset Inventory​

The inventory lives on Assets, in the navigation rail (URL path /v2/assets), titled Assets Search and subtitled List of registered / discovered assets with data ingress. A full-width Search assets… field spans the page, with a Filters panel on the left and the asset table on the right; Download Assets and Add Asset sit in the header. The table has Name, Description, Providers, Model, Machine Type, Operating System, Status, and Actions columns.

Assets Search page with Download Assets and Add Asset buttons, a search bar, the Filters panel on the left, and a table of three syslog sender assets

How Devices Get There​

  • Through their template's parser. When a syslog template's parser claims a device's records, it registers the device the first time it sees it, with a machine type for that kind of device (a Linux host becomes a Linux Server) named after the host name in the device's syslog header, or its address where the header has none. This is why a distinct host name on every device matters: devices sharing a NAT with no host names in their headers register as one asset.
  • Through the catch-all. A device that sends through a collector from a private address, in a format no installed template recognises, is still registered, as Syslog - followed by its address. Devices sending to the cloud endpoint are not registered this way. An unexpected Syslog - entry usually means a device whose template is not installed, or whose format its template does not recognise; see Syslog → Format.
  • By hand. Add Asset registers one. Its single Details section takes Name (required), Description, Fully Qualified Domain Name (FQDN), Model, Machine Type, and Operating System; click Add to save.

Add Asset dialog with a Details section listing the Name, Description, FQDN, Model, Machine Type, and Operating System fields above Cancel and Add buttons

Detecting a Device That Stopped​

Silence is the failure mode a SIEM is least likely to alert on by itself, and syslog makes it worse: a device that stops sending produces no error anywhere. The per-device import counts the parsers record are what make it detectable. Where a metric alert is configured to raise a ticket for a device going quiet, that ticket surfaces on the metric alerts page:

Metric Alerts, in the navigation rail (URL path /v2/metric-alerts), lists them: for a syslog source that stopped sending, an FPL_Import_Source_Stop alert. Three counters report Total, Resolved, and New for the selected window; the filter bar's Window offers 1D (the default), 3D, 7D, 30D, 90D, All time, and Custom, beside Status, Sort, and a Search field. The list below has one row per alert, with ALERT (and when it was first seen), ENTITY (and when it was last seen), SEVERITY, and STATUS columns.

Metric Alerts with the Window set to 7D, showing a Warn severity tile and two resolved FPL_Import_Source_Stop alerts, each with its entity, first-seen and last-seen times

Act on those tickets quickly. A syslog device does not store and resend what it could not deliver: anything a device sends directly to a listener while the path is broken is gone. A collector in between narrows the gap (it queues what it cannot upload, up to the limit of its disk), but it cannot recover what never reached it.

For devices that are busy by nature (a firewall carrying traffic, a domain controller), volume itself is a usable check: an hour of silence is a fault, not a quiet hour.

Onboarding and Retiring Devices​

Onboarding. Install the device's template once (see On-Prem / Syslog) and then point each device at a listener. Install the template first, so the first records are parsed and the device registers under the right type.

Retiring a device. Stop it sending first. Some devices fail closed: when a reliable (TCP or TLS) log destination goes away, they stop passing traffic. Leave the template installed while any device of that kind still sends; one template serves them all.

Replaying archived syslog. Archived collector and syslog data can be replayed from an S3 bucket through the syslog router; see Cloud Storage → Replaying an Archive From S3.

Last updated on